A medical data security management method

Abstract

This invention discloses a method for medical data security management. The invention relates to the field of medical data management technology. The method includes: constructing a two-dimensional desensitization matrix based on the sensitivity level and historical access frequency of medical data, and then performing differentiated desensitization on data of different risk levels after dynamic risk clustering; verifying user roles, current tasks, and device fingerprints, and dynamically generating the user's permission scope and validity period; monitoring user operation behavior in real time, and determining whether anomalies are reasonable deviations based on the task scenario; encrypting operation records using national cryptographic algorithms, and forming an encrypted log chain using timestamps. This invention effectively balances the security and availability of medical data, improving access control while ensuring traceability throughout the entire operation process.

Description

Technical Field

[0001] This invention relates to the field of medical data management technology, specifically a method for medical data security management. Background Technology

[0002] Medical data security management is a core component of healthcare IT infrastructure development; however, existing medical data security management technologies still have the following shortcomings:

[0003] Firstly, existing technologies mostly perform desensitization based on the sensitivity level of the data, without dynamically adjusting the protection strength according to the historical access frequency of the data. This results in the efficiency of diagnosis and treatment of frequently used routine medical data being affected by excessive desensitization, while highly sensitive data that is accessed infrequently is at risk of privacy leakage due to insufficient protection.

[0004] Secondly, the compliance verification of data operations did not take into account the current medical task scenario to judge the reasonable deviation of the operation, resulting in a high false positive rate. At the same time, after the abnormal behavior was intercepted, there was a lack of complete record of the operation trajectory, making it difficult to locate the root cause of the problem in subsequent tracing.

[0005] Third, operation records are mostly stored using simple encryption, without forming a chain-like association or a reliable time sequence, making the encrypted content easy to tamper with;

[0006] Therefore, there is an urgent need for a method for managing medical data security. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention provides a medical data security management method that solves the problems of rigid desensitization, static permissions, and unreliable evidence storage in existing medical data.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a medical data security management method, comprising:

[0009] Step 1: Divide medical data into four categories based on sensitivity level: core, high, medium and low. At the same time, count the historical access frequency and divide it into two categories: high frequency and low frequency. Construct a two-dimensional desensitization matrix and perform dynamic risk clustering to obtain three risk levels: high, medium and low. Perform different desensitization processes on the medical data in these three risk levels respectively.

[0010] Step 2: When requesting permissions, the system automatically verifies the user's role, current task, and access device fingerprint, and automatically generates the current user's permission scope and validity period.

[0011] Step 3: During the data retrieval, modification, and transmission process, monitor in real time whether the operation behavior complies with the permission scope. If it does not, mark it as a potential anomaly and, in combination with the current task scenario, determine whether the potential anomaly is a reasonable deviation.

[0012] Step 4: Encrypt all operation records using the SM4 national cryptographic algorithm and combine them with the timestamp from the National Time Service Center to obtain an encrypted log chain. The operation records include desensitization rules, permission parameters, and anomaly interception information.

[0013] As a further aspect of the present invention, the specific operation of dynamic risk clustering based on a two-dimensional desensitization matrix is ​​as follows:

[0014] Dynamic weight values ​​are assigned to the sensitivity level and access frequency of medical data to obtain the final sensitivity level weight S and the final access frequency weight F.

[0015] For the 8 cells in the two-dimensional matrix, namely 4 sensitivity levels × 2 frequency levels, the risk value of each medical data is calculated according to the following formula: Risk value = final sensitivity level weight S × sensitivity coefficient + final access frequency weight × frequency coefficient, where the sensitivity coefficient and frequency coefficient are both quantified values, with 4 corresponding to the core sensitivity level, 3 corresponding to the high sensitivity level, 2 corresponding to the medium sensitivity level, 1 corresponding to the low sensitivity level, 2 corresponding to the high frequency level, and 1 corresponding to the low frequency level.

[0016] The natural breakpoint method is used to cluster the risk values ​​of 8 cells, automatically generating 3 risk intervals, each interval corresponding to a class of data.

[0017] As a further aspect of the present invention, the specific operation of assigning dynamic weight values ​​to the sensitivity level and access frequency of medical data is as follows:

[0018] Set the basic weight for sensitivity level: S for core sensitivity level base Take 0.7, S for high sensitivity level base Take 0.5, S for medium sensitivity level base Take 0.3, low sensitivity level S base Take 0.1;

[0019] Set the base weight F for access frequency base This value dynamically adjusts the base weight based on risk volatility: for high-frequency data, if risk volatility > Rv, the initial value of the base weight is 0.5; if risk volatility ≤ Rv, the initial value of the base weight is 0.3. For low-frequency data, the base weight is fixed at 0.2, where Rv is the volatility threshold, and the risk volatility = standard deviation of visits in the past 3 months / average visits.

[0020] The regulating factor K is defined by the following formula: The basic weights are then mapped to the final sensitivity level weight S and the final access frequency weight F, ensuring that S + F = 1, where S = S base ×K,F=F base ×K;

[0021] If the medical data is classified as critical and was obtained within one month, then S base Automatically increase by 20%; if the access frequency is high and the risk volatility is greater than Rv1, then F base Automatically increase by 30%, where Rv1 is the volatility threshold and Rv1 > Rv.

[0022] As a further aspect of the present invention, the specific operation of clustering the risk values ​​of 8 cells using the natural breakpoint method is as follows:

[0023] Eight cells are constructed based on sensitivity level and access frequency, namely S1F1, S1F2, S2F1, S2F2, S3F1, S3F2, S4F1, and S4F2. S1, S2, S3, and S4 represent core, high, medium, and low sensitivity levels, respectively, and F1 and F2 represent high frequency and low frequency, respectively.

[0024] All raw medical data are assigned to corresponding cells according to their attributes, and the risk value of each raw data point in each cell is calculated to obtain a batch risk value set X={x1,x2,...,x...} covering all raw data. n}, where n is the total amount of original data;

[0025] For X, the core criterion for clustering is defined as the within-cluster sum of squares (SDCM), and the specific formula is as follows: Among them, C1, C2, and C3 are three risk intervals to be generated. For interval C i The mean of all risk values ​​within the interval C, where x is the interval C. i A single risk value within;

[0026] Arrange the batch risk value set X in ascending order to obtain the ordered set X'={x1',x2',...,x n '}, where x1' < x2' < ... < x n ';

[0027] Determine two breakpoints, denoted as b1 and b2, where b1 < b2, and divide the ordered set X' into three continuous intervals: C1 corresponds to [min(X'), b1], C2 corresponds to (b1, b2], and C3 corresponds to (b2, max(X')]. Enumerate all possible combinations of breakpoints.

[0028] For each breakpoint combination, calculate the intraclass sum of squares of the three intervals, sum them to obtain the total SDCM of the combination, and select the breakpoint group with the smallest total SDCM from all combinations. The corresponding three intervals are the optimal risk intervals for batch data.

[0029] The three generated optimal risk intervals are sorted according to the range of risk values ​​they contain, resulting in a low-range interval, a medium-range interval, and a high-range interval. The sorting results are then linked to the risk level: the high-range interval is classified as a high-risk level, the medium-range interval as a medium-risk level, and the low-range interval as a low-risk level. The low-range interval represents the interval containing the minimum risk value among the optimal risk intervals, the high-range interval represents the interval containing the maximum risk value among the optimal risk intervals, and the remaining interval corresponds to the medium-range interval.

[0030] As a further aspect of the present invention, different desensitization processes are performed on data at high, medium, and low risk levels, specifically as follows:

[0031] For high-risk levels, full field replacement plus random perturbation is used; for medium-risk levels, partial masking plus format preservation is used; for low-risk levels, only identifier desensitization is performed.

[0032] The specific content of the full-field replacement + random perturbation method is as follows: Analyze the data structure in the high-risk level and locate all core sensitive fields, including identification fields and content fields; for identification fields, use meaningless character replacement; for non-numerical content fields, use semantically irrelevant replacement; for numerical content fields, generate random perturbation values ​​within a preset safety range, but ensure that the perturbed data still conforms to the medical logic range, and then perform format obfuscation on the perturbed values ​​again.

[0033] The specific content of the partial masking + format retention method is as follows: clearly define the format elements that need to be retained and the sensitive parts that need to be masked for each data in the medium-risk level. The format elements that need to be retained include data units, number of digits, and key identifiers. The sensitive parts that need to be masked include the middle digits of the precise value and non-key personal identifiers.

[0034] For numerical data, mask the middle precision bits while retaining the first and last bits and units; for text-based diagnostic records, mask the detailed description while retaining the core diagnosis; for identifier-type data, mask the middle date portion.

[0035] As a further aspect of the present invention, the specific steps for automatically generating the current user's permission scope and validity period are as follows:

[0036] For user roles, current tasks, and access device fingerprints, core attributes are extracted and standardized mapping relationships are established: for user roles, basic operation permissions can be mapped according to qualification level; for current tasks, basic data range can be mapped according to medical process nodes; and for access device fingerprints, basic duration can be mapped according to device security level.

[0037] The current task is broken down into standardized process nodes, each node is associated with a clear data requirement label, and based on the basic data range, only the data that matches the current node label is retained to form a real-time permission range. If the task is switched from one node to the next, the permission range is automatically updated synchronously.

[0038] The system monitors the current security level of the accessed device in real time. If the security level increases, the base duration is extended to 120% of the base duration of the previous security level. If the security level decreases, the base duration is shortened to 50% of the base duration of the previous security level. At the same time, if the device status changes within the validity period of the permission, the duration is immediately recalculated according to the new level.

[0039] Record the historical behavior trajectory of the character in the same type of task and on the same type of device to form a behavior baseline. The historical behavior trajectory is the average time and fluctuation range of the character in completing the same node in the same type of task.

[0040] Compare the deviation between the currently requested permission duration and the behavior baseline: if the deviation is within the specified fluctuation range, the verification will pass directly; otherwise, a second confirmation will be triggered. Only after the second confirmation passes will the user's requested permissions take effect, and the behavior baseline will be updated. If the verification fails, the permissions will be adjusted to the baseline range.

[0041] As a further aspect of the present invention, the specific steps for real-time monitoring of whether operational behavior complies with the scope of permissions are as follows:

[0042] The generated permission scope is transformed into a structured set of feature tags, containing four core verification features: patient association features, a set of patient IDs bound to the current task; data field features, specific data field tags that are allowed to be operated on; operation type features, allowed operation actions; and device binding features, a list of authorized device fingerprints.

[0043] When data retrieval, modification, and transmission operations are triggered, the lightweight parsing module extracts four types of behavioral features of the current operation in real time and compares them one by one with the feature label set. If any dimension does not match, it is marked as a potential anomaly. In combination with the current task scenario, it is determined whether the potential anomaly is a reasonable deviation. If it is a reasonable deviation, the anomaly label is removed; otherwise, it is determined to be a real anomaly.

[0044] As a further aspect of the present invention, if a genuine anomaly is identified, the following operations are performed immediately: ① The current operation process is immediately frozen, but the records of completed compliant operations are retained; ② The specific characteristics of the anomaly are automatically recorded and associated with the current task details and user information to generate a standardized anomaly report; ③ Different levels of alerts are pushed to the administrator based on the number of anomaly dimensions.

[0045] As a further aspect of the present invention, the specific steps for obtaining the encrypted log chain are as follows:

[0046] All operation records generated are structured according to four dimensions: operation subject, operation object, operation content, and operation result, generating standardized log entries. Specifically, these include: operation subject, including user ID, role, and operation device fingerprint; operation object, including patient ID and data anonymization features; operation content, including permission range parameters and operation behavior type; and operation result, including normal completion and abnormal interception.

[0047] The generated structured log entries are fully encrypted using the SM4 national cryptographic block encryption algorithm to generate encrypted log data E. m And the SM3 national cryptographic hash algorithm is used to encrypt the E m Calculate the hash value H m At the same time, the hash value H of the previous log entry is embedded in the current log unit. m-1 This forms "Log Unit = Encrypted Data E" m +self-hashH m +Preorder hash H m-1 The structure is "", where m is the log sequence number;

[0048] When each log unit is generated, the system automatically requests a unique timestamp T from the National Time Service Center. m , timestamp T m Embedding the corresponding log unit forms "Complete Log Unit = Encrypted Data E" m +self-hashH m +Preorder hash H m-1 +timestampT m ", and by timestamp T m The complete log units are aggregated into an encrypted log chain in a specific order and stored on an offline encryption server. Simultaneously, a chain index is generated, which contains the T of each log entry. m With H m .

[0049] As a further aspect of the present invention, the preceding hash H0 of the first log entry is set as the root hash preset by the system and generated by the organization's digital certificate.

[0050] This invention provides a method for medical data security management, which has the following advantages compared with the prior art:

[0051] (1) This invention constructs a two-dimensional desensitization matrix by using data sensitivity level and historical access frequency, and combines dynamic risk clustering to generate a desensitization strategy that adapts to the risk level, thus avoiding the problem of over-protection or under-protection of data caused by the single-dimensional desensitization of existing technologies.

[0052] (2) This invention generates temporary permissions based on user roles, real-time tasks and device security status, dynamically calibrates the permission range and validity period through task nodes, and combines the baseline verification of role historical behavior to solve the defects of excessive authorization of existing static permissions or delayed response in emergency scenarios.

[0053] (3) This invention encrypts operation records using the SM4 national cryptographic algorithm and constructs an encrypted log chain by combining chain association with the timestamp of the National Time Service Center. This avoids the problems of easy tampering and unreliable timing of existing evidence storage, and solves the defects of high misjudgment rate in mechanical monitoring. At the same time, operation records can be double-verified through hash chain and timestamp to meet compliance traceability requirements. Attached Figure Description

[0054] Figure 1 This is a flowchart of the steps of the present invention;

[0055] Figure 2 This is a flowchart illustrating the steps involved in dynamic risk clustering in this invention.

[0056] Figure 3 A flowchart illustrating the steps involved in constructing the encrypted log chain for this invention. Detailed Implementation

[0057] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] Example 1

[0059] like Figure 1 This invention provides a method for medical data security management, comprising:

[0060] Step 1: Divide medical data into four categories based on sensitivity level: core, high, medium and low. At the same time, count the historical access frequency and divide it into two categories: high frequency and low frequency, and construct a two-dimensional desensitization matrix.

[0061] Medical data contains a large amount of personal privacy and life and health information. The risks of leakage and compliance requirements for different types of data vary significantly: the leakage of core sensitive data may lead to the complete exposure of patient privacy and requires the strictest protection; while the leakage of low-sensitivity data, such as height and weight records, has a smaller impact, and over-protection will reduce the efficiency of data use.

[0062] The specific steps for classifying medical data into core, high, medium, and low sensitivity levels are as follows:

[0063] Based on the privacy relevance and impact of medical data leaks, pre-defined data sensitivity classification standards are established: Core Sensitive: Data directly related to patients' core privacy and with serious consequences of leakage, such as gene sequencing results and medical history; High Sensitive: Data related to key health information, such as key inpatient diagnoses and surgical records; Moderately Sensitive: Data containing personal identifiers but with moderate impact, such as preliminary outpatient diagnoses, routine laboratory indicators, and medication lists; Low Sensitive: Data with extremely low risk after de-identification, such as height, weight, and departmental statistics.

[0064] Field parsing is performed on data sources such as electronic medical records, laboratory systems, and imaging systems to extract key information;

[0065] Build a sensitive field rule base and use NLP technology to identify sensitive information in unstructured text;

[0066] The system automatically matches data to the corresponding sensitivity level, generates sensitivity level labels, and supports manual review;

[0067] The historical access frequency of medical data is directly related to the balance between its use value and security requirements: high-frequency access data is the basis of medical staff's daily diagnosis and treatment, such as routine outpatient test indicators. If the anonymization is too strict, it will frequently affect work efficiency; while low-frequency access data has fewer use cases, such as rare disease diagnosis records. Even if strict anonymization is adopted, the impact on business is minimal, but it can significantly reduce the security risks of long-term storage.

[0068] The specific steps for statistically analyzing historical access frequencies and classifying them into high-frequency and low-frequency categories are as follows:

[0069] Collect medical data from the past 3 months. If the number of accesses to a single data point is greater than or equal to a threshold M, it is classified as high-frequency data; otherwise, it is classified as low-frequency data. M is set according to the workload of the department.

[0070] Deploy access counters on data access interfaces, such as electronic medical record query interfaces, to record the access time, visitor, and purpose of each piece of data;

[0071] The system automatically summarizes the number of visits over the past 3 months every 7 days and compares it with the threshold M, marking the data as high frequency or low frequency. Newly generated data, such as newly entered hospitalization records, are temporarily classified as low frequency by default, and will be reclassified according to the actual number of visits after 1 month.

[0072] The access trends of high-frequency data are analyzed monthly. If the number of accesses to a certain high-frequency data is less than M for two consecutive months, it will be automatically adjusted to low frequency. For low-frequency data, if the number of accesses suddenly increases, it will be temporarily marked as high frequency and re-evaluated according to the regular standards after one month.

[0073] Dynamic risk clustering is performed based on a two-dimensional desensitization matrix to divide medical data into three risk levels: high, medium, and low. Different desensitization processes are then applied to each level. The specific operations are as follows:

[0074] For high-risk levels, a full-field replacement plus random perturbation is used, specifically including:

[0075] Analyze the data structure in the high-risk category and locate all core sensitive fields: identification fields, including patient ID, name, test number and other information directly related to personal identity; content fields, such as test results, viral load values ​​and other core sensitive content;

[0076] For identifier fields, use meaningless character replacement, such as replacing the patient ID "PAT-2025001" with "ID-XYZ789" and the name "Zhang San" with "User A", to ensure that the real identity cannot be reversed after the replacement;

[0077] For non-numeric fields in the content category, semantically irrelevant replacements are used, such as replacing "positive" in HIV test results with "category C" and "negative" with "category A", and the replacement rules are dynamically updated;

[0078] For numeric fields, generate random perturbation values ​​within a preset safety range, such as ±5% of the original value. However, it is necessary to ensure that the perturbed data still conforms to the medical logic range, and further obfuscate the format of the perturbed values ​​to hide the original unit characteristics.

[0079] For medium-risk levels, a partial masking and format preservation method is used, specifically including:

[0080] The format elements that need to be retained and the sensitive parts that need to be masked for each data in the medium-risk level are clearly defined. The format elements that need to be retained include data units, number of digits, and key identifiers; the sensitive parts that need to be masked include the middle digits of the precise value and non-key personal identifiers.

[0081] For numerical data, mask the middle precision bits while retaining the first and last bits and units; for text-based diagnostic records, mask the detailed description while retaining the core diagnosis; for identifier-type data, mask the middle date portion.

[0082] After anonymizing the data, re-verify whether the data conforms to the set format elements. For data that does not conform, automatically roll back and reprocess it.

[0083] For low-risk data, only labeling and desensitization are performed. Low-risk data is usually large in volume, and using simple labeling and desensitization can reduce the time cost and system overhead of the desensitization process and reduce business interruptions caused by complex processing.

[0084] Step 2: When requesting permissions, the system automatically verifies the user's role, current task, and access device fingerprint, and automatically generates the current user's permission scope and validity period. Permissions will automatically expire when the task is completed.

[0085] The specific steps for automatically generating the current user's permission scope and validity period are as follows:

[0086] For user roles, current tasks, and access device fingerprints, extract core attributes and establish standardized mapping relationships:

[0087] For user roles, basic operation permissions can be mapped according to qualification level. For example, if R1 is a chief physician, R2 is an attending physician, and R3 is an intern, R1 has permissions such as viewing and modifying, while R3 only has viewing permissions.

[0088] For the current task, the basic data range is mapped according to the nodes of the medical process. For example, T1 is outpatient reception, T2 is medical record review, and T3 is remote consultation. T1 is associated with the patient's basic medical history, current symptoms, etc., while T2 is only associated with the medical record text.

[0089] For accessing device fingerprints, the base duration is mapped according to the device security level. For example, if D1 is a trusted device on the internal network, D2 is a semi-trusted mobile device, and D3 is a public untrusted device, the base duration of D1 is set as the standard duration of the task, D2 can be set to 70% of D1, and D3 can be set to 50% of D1.

[0090] The current task is broken down into standardized process nodes, with each node associated with a specific data requirement tag. For example, "outpatient reception" is broken down into T... 11 - Consultation, T 12 -Issue an inspection, T 13 -Diagnostic conclusion, T 12 It requires "inspection item database + previous inspection records";

[0091] Based on the basic data range, only data matching the current node label is retained to form a real-time permission range. If the task switches from one node to the next, the permission range is automatically updated to avoid over-authorization caused by opening all data for the same task.

[0092] The system monitors the current security level of the accessed device in real time. If the security level increases, the base duration is extended to 120% of the base duration of the previous security level. If the security level decreases, the base duration is shortened to 50% of the base duration of the previous security level. At the same time, if the device status changes within the validity period of the permission, the duration is immediately recalculated according to the new level.

[0093] Record the historical behavior trajectory of the character in the same type of task and on the same type of device to form a behavior baseline. The historical behavior trajectory is the average time and fluctuation range of the character in completing the same node in the same type of task.

[0094] Compare the deviation between the currently requested permission duration and the behavior baseline: if the deviation is within the specified fluctuation range, the verification will pass directly; otherwise, a second confirmation will be triggered. Only after the second confirmation passes will the user's requested permissions take effect, and the behavior baseline will be updated. If the verification fails, the permissions will be adjusted to the baseline range.

[0095] Step 3: During the data retrieval, modification, and transmission process, monitor in real time whether the operation behavior complies with the permission scope. The specific steps are as follows:

[0096] The generated permission scope is transformed into a structured set of feature labels, containing four core verification features:

[0097] Patient association features: a set of patient IDs bound to the current task, such as {P1, P2, P3}, which only allows access to the data of these 3 patients;

[0098] Data field characteristics, specific data field labels that are allowed to be operated on, such as {diagnosis conclusion, test indicators, medication records}, excluding unauthorized fields such as "past medical history";

[0099] Operation type characteristics, allowing operations such as {view, annotate}, and prohibiting operations such as "modify, transfer";

[0100] Device binding characteristics, a list of authorized device fingerprints, such as {D1,D2}, only these two devices can perform the operation;

[0101] When data retrieval, modification, or transmission operations are triggered, the lightweight parsing module extracts four types of behavioral features of the current operation in real time and compares them one by one with the feature label set:

[0102] If any dimension does not match, it is marked as a potential anomaly, such as the patient ID in the behavioral characteristics not being in the authorized patient set;

[0103] Based on the current task scenario, determine whether potential anomalies are reasonable deviations. Specifically:

[0104] Each medical task scenario (such as outpatient visits, remote consultations, and emergency resuscitation) is broken down into three core elements and structured with tags:

[0105] Core objective elements, that is, the core purpose of the task;

[0106] Essential data association elements are the range of data that must be associated to complete the task. For example, T1 needs to be associated with "the current patient's previous medical records and the current test results".

[0107] Operational constraints are the prohibited operational boundaries in a task, such as T1 prohibiting "transferring the complete patient medical record to an external email address";

[0108] Based on the above task scenarios, typical cases in medical practice that are "outside the scope of authority but meet the needs of the scenario" are identified, forming a dynamically updatable rule base for reasonable deviations. Each rule includes:

[0109] Triggering conditions, i.e. the characteristics of potential anomalies; scene element matching items, i.e. the core target elements that need to be met + necessary data association elements.

[0110] When a potential anomaly is detected, the system automatically performs the following operations: for the current task scenario, extract core target elements, necessary data association elements, and operational constraint elements; search the reasonable deviation rule base and match the rule entries corresponding to the potential anomaly characteristics; verify whether the current scenario elements fully meet the scenario element matching items in the rules: if they fully meet the rules, it is determined to be a reasonable deviation and the anomaly mark is removed; otherwise, it is determined to be a real anomaly.

[0111] If the exception is determined to be a genuine exception, the following actions will be taken immediately:

[0112] ① Immediately freeze the current operation process, but retain the record of completed compliant operations; ② Automatically record the specific characteristics of the anomaly and associate them with the current task details and user information to generate a standardized anomaly report; ③ Push different levels of alerts to the administrator based on the number of anomaly dimensions (single-dimensional anomaly / multi-dimensional anomaly), such as triggering an emergency alert for multi-dimensional anomalies and triggering a regular alert for single-dimensional anomalies.

[0113] Step 4: Encrypt all operation records (including desensitization rules, permission parameters, and abnormal interception information) using the SM4 national cryptographic algorithm and combine them with the timestamp from the National Time Service Center to obtain an encrypted log chain;

[0114] When it is necessary to trace back an operation, the following operations can be performed:

[0115] The log cell related to the operation is retrieved by the chain index. Starting from the log cell, the hash of each log cell is checked backward to see if it matches the previous hash of the next log cell, until the root hash is reached. If the entire chain matches, the log cell is determined to have not been tampered with.

[0116] Extract the timestamps from the relevant logs and verify the validity of the timestamp signatures through the verification interface of the National Time Service Center to confirm the actual order of the operations.

[0117] Finally, a traceability report is generated that includes "integrity verification results + timing verification results + key operational characteristics". The traceability report clearly states whether the operation was compliant, whether it was tampered with, and the order in which it occurred.

[0118] Example 2

[0119] This embodiment further discloses a method for dynamic risk clustering based on a two-dimensional desensitization matrix, building upon Embodiment 1. Figure 2 As shown, the specific content includes:

[0120] Dynamic weight values ​​are assigned to sensitivity levels (core, high, medium, low) and access frequencies (high frequency, low frequency), specifically including:

[0121] Set the basic weight for sensitivity level: S for core sensitivity level base Take 0.7, S for high sensitivity level base Take 0.5, S for medium sensitivity level base Take 0.3, low sensitivity level S base Take 0.1;

[0122] Set the base weight F for access frequency base This value is based on risk volatility, which is calculated as the standard deviation of visits over the past 3 months divided by the average number of visits. For high-frequency data, if the risk volatility is greater than Rv, the initial value of the basic weight is 0.5; if the risk volatility is less than or equal to Rv, the initial value of the basic weight is 0.3. For low-frequency data, volatility is not considered, and the basic weight is fixed at 0.2. Here, Rv is the volatility threshold, which needs to be set according to the actual situation.

[0123] The regulating factor K is defined by the following formula: The basic weights are then mapped to the final sensitivity level weight S and the final access frequency weight F, ensuring that S + F = 1, where S = S base ×K,F=F base ×K;

[0124] If the medical data is classified as critical and was obtained within one month, then S base The weight of S is automatically increased by 20% by adjusting factor K, and the final weight of S will be significantly higher than that of F, ensuring that core privacy is protected first.

[0125] When the access frequency is high and the risk volatility is greater than Rv1, then F base The weight of F is automatically increased by 30%, thus increasing the final weight of F and preventing high-frequency fluctuation data from being underestimated due to insufficient weight. Here, Rv1 is the volatility threshold and Rv1 > Rv.

[0126] For the 8 cells in the two-dimensional matrix, namely 4 sensitivity levels × 2 frequency levels, the risk value of each medical data is calculated according to the following formula: Risk value = final sensitivity level weight S × sensitivity coefficient + final access frequency weight × frequency coefficient, where the sensitivity coefficient and frequency coefficient are both quantified values, with 4 corresponding to the core sensitivity level, 3 corresponding to the high sensitivity level, 2 corresponding to the medium sensitivity level, 1 corresponding to the low sensitivity level, 2 corresponding to the high frequency level, and 1 corresponding to the low frequency level.

[0127] The natural breakpoint method was used to cluster the risk values ​​of the 8 cells, automatically generating 3 risk intervals, each interval corresponding to one class of data. The specific operation is as follows:

[0128] Eight cells are constructed based on sensitivity level (core S1, high S2, medium S3, low S4) and access frequency (high frequency F1, low frequency F2), namely S1F1, S1F2, S2F1, S2F2, S3F1, S3F2, S4F1, S4F2.

[0129] All raw medical data are assigned to corresponding cells according to their attributes. For example, a medical record involving genetic information with a sensitivity level of S1 and an access frequency of F2 is assigned to cell S1F2.

[0130] Calculate the risk value for each original data entry in each cell to obtain a batch risk value set X={x1,x2,...,x...} covering all original data. n Furthermore, for X, the core criterion for clustering is defined as the within-cluster sum of squares (SDCM), with the specific formula as follows: Among them, C1, C2, and C3 are three risk intervals to be generated. For interval C i The mean of all risk values ​​within the interval C, where x is the interval C. i A single risk value within the data, where n is the total amount of original data;

[0131] The clustering objective is to divide all risk values ​​in set X into three intervals, minimizing the sum of the SDCM of the three intervals, i.e., small differences in data within intervals and large differences in data between intervals;

[0132] Arrange the batch risk value set X in ascending order to obtain the ordered set X'={x1',x2',...,x n '}, where x1' < x2' < ... < x n ';

[0133] We need to determine two breakpoints, b1 and b2, where b1 < b2, and divide the ordered set X' into three continuous intervals: C1 corresponds to [min(X'), b1], C2 corresponds to (b1, b2], and C3 corresponds to (b2, max(X')]. We need to enumerate all possible combinations of breakpoints (choosing two from the n-1 intervals of the ordered set, the total number of combinations is...). );

[0134] For each breakpoint combination, calculate the intraclass sum of squares of the three intervals, sum them to obtain the total SDCM of the combination, and select the breakpoint group with the smallest total SDCM from all combinations. The corresponding three intervals are the optimal risk intervals for batch data.

[0135] After obtaining the three optimal risk intervals, it is necessary to determine the level of each risk interval, including:

[0136] The three generated optimal risk intervals are sorted according to the range of risk values ​​they contain, resulting in a low-range interval, a medium-range interval, and a high-range interval. The low-range interval represents the interval containing the minimum risk value among the optimal risk intervals, and the high-range interval represents the interval containing the maximum risk value among the optimal risk intervals. After determining the low-range interval and the high-range interval, the last one remaining is the corresponding medium-range interval.

[0137] The sorting results are linked to the risk level, i.e., the high range is determined to be high risk level, the medium range is determined to be medium risk level, and the low range is determined to be low risk level.

[0138] Example 3

[0139] This embodiment further discloses a method for constructing an encrypted log chain based on embodiments 1 and 2, such as... Figure 3 As shown, the specific process is as follows:

[0140] All operation records generated are structured according to four dimensions: operation subject, operation object, operation content, and operation result, generating standardized log entries. Specifically, these include: operation subject, including user ID, role, and operation device fingerprint; operation object, including patient ID and data anonymization features; operation content, including permission scope parameters and operation behavior type (view / modify / transfer); and operation result, including normal completion and abnormal interception.

[0141] The generated structured log entries are fully encrypted using the SM4 national cryptographic block encryption algorithm to generate encrypted log data E. m And the SM3 national cryptographic hash algorithm is used to encrypt the E m Calculate the hash value H m At the same time, the hash value H of the previous log entry is embedded in the current log unit.m-1 This forms "Log Unit = Encrypted Data E" m +self-hashH m +Preorder hash H m-1 The structure is "", where m is the log sequence number;

[0142] The preceding hash H0 of the first log (i.e., n=1) is set to the system's preset root hash, which is generated by the organization's digital certificate to ensure that the starting point of the log chain is unique and cannot be tampered with.

[0143] When each log unit is generated, the system automatically requests a unique timestamp T from the National Time Service Center. m , timestamp T m Embedding the corresponding log unit forms "Complete Log Unit = Encrypted Data E" m +self-hashH m +Preorder hash H m-1 +timestampT m ", and by timestamp T m The complete log units are aggregated into an encrypted log chain in a specific order and stored on an offline encryption server. Simultaneously, a chain index is generated, which contains the T of each log entry. m With H m This is to facilitate quick retrieval.

[0144] Some of the data in the above formulas are numerical calculations with dimensions removed, and the contents not described in detail in this specification are all prior art known to those skilled in the art.

[0145] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A method for managing medical data security, characterized in that, include: Step 1: Divide medical data into four categories based on sensitivity level: core, high, medium and low. At the same time, count the historical access frequency and divide it into two categories: high frequency and low frequency. Construct a two-dimensional desensitization matrix and perform dynamic risk clustering to obtain three risk levels: high, medium and low. Perform different desensitization processes on the medical data in these three risk levels respectively. Step 2: During permission request, the system automatically verifies the user role, current task, and access device fingerprint, and automatically generates the current user's permission scope and validity period. The specific steps for automatically generating the current user's permission scope and validity period are as follows: For the user role, current task, and access device fingerprint, core attributes are extracted and standardized mapping relationships are established: For the user role, basic operation permissions are mapped according to qualification level; for the current task, basic data scope is mapped according to medical process nodes; for the access device fingerprint, basic duration is mapped according to device security level; the current task is broken down into standardized process nodes, each node is associated with a clear data requirement tag, and according to the basic data scope, only data matching the current node tag is retained to form a real-time permission scope. If the task switches from one node to the next, the permission scope is automatically synchronized. Update; Real-time monitoring of the current security level of the accessed device. If the security level increases, the base duration is extended to 120% of the previous security level's base duration; if the security level decreases, the base duration is shortened to 50% of the previous security level's base duration. Simultaneously, if the device status changes within the permission validity period, the duration is immediately recalculated according to the new level. Record the role's historical behavior trajectory on similar tasks and devices to form a behavior baseline. The historical behavior trajectory is the average duration and fluctuation range of the role completing the same node in similar tasks. Compare the deviation between the currently requested permission duration and the behavior baseline: If the deviation is within the specified fluctuation range, the verification is passed directly; otherwise, a second confirmation is triggered. Only after the second confirmation is passed will the user's requested permission take effect, and the behavior baseline is updated. If it fails, the permission is adjusted to the baseline range. Step 3: During the data retrieval, modification, and transmission process, monitor in real time whether the operation behavior complies with the permission scope. If it does not, mark it as a potential anomaly and, in combination with the current task scenario, determine whether the potential anomaly is a reasonable deviation. Step 4: Encrypt all operation records using the SM4 national cryptographic algorithm and combine them with the timestamp from the National Time Service Center to obtain an encrypted log chain. The operation records include desensitization rules, permission parameters, and anomaly interception information.

2. The medical data security management method according to claim 1, characterized in that, The specific steps for dynamic risk clustering based on a two-dimensional desensitization matrix are as follows: Dynamic weight values ​​are assigned to the sensitivity level and access frequency of medical data to obtain the final sensitivity level weight S and the final access frequency weight F. For the 8 cells in the two-dimensional matrix, namely 4 sensitivity levels × 2 frequency levels, the risk value of each medical data is calculated according to the following formula: Risk value = final sensitivity level weight S × sensitivity coefficient + final access frequency weight × frequency coefficient, where the sensitivity coefficient and frequency coefficient are both quantified values, with 4 corresponding to the core sensitivity level, 3 corresponding to the high sensitivity level, 2 corresponding to the medium sensitivity level, 1 corresponding to the low sensitivity level, 2 corresponding to the high frequency level, and 1 corresponding to the low frequency level. The natural breakpoint method is used to cluster the risk values ​​of 8 cells, automatically generating 3 risk intervals, each interval corresponding to a data class.

3. The medical data security management method according to claim 2, characterized in that, The specific steps for assigning dynamic weight values ​​to the sensitivity level and access frequency of medical data are as follows: Set the basic weight for sensitivity level: S for core sensitivity level base Take 0.7, S for high sensitivity level base Take 0.5, S for medium sensitivity level base Take 0.3, low sensitivity level S base Take 0.1; Set the base weight F for access frequency base Access frequency base weight F base The base weight is dynamically adjusted based on risk volatility: For high-frequency data, if the risk volatility > Rv, the initial value of the base weight is 0.5, and if the risk volatility ≤ Rv, the initial value of the base weight is 0.3; for low-frequency data, the base weight is fixed at 0.2, where Rv is the volatility threshold, and the risk volatility = standard deviation of visits in the past 3 months / average visits. The regulating factor K is defined by the following formula: The basic weights are then mapped to the final sensitivity level weight S and the final access frequency weight F, ensuring that S + F = 1, where S = S base ×K,F=F base ×K; If the medical data is classified as critical and was obtained within one month, then S base Automatically increase by 20%; if the access frequency is high and the risk volatility is greater than Rv1, then F base Automatically increase by 30%, where Rv1 is the volatility threshold and Rv1 > Rv.

4. The medical data security management method according to claim 2, characterized in that, The specific steps for clustering the risk values ​​of 8 cells using the natural breakpoint method are as follows: Eight cells are constructed based on sensitivity level and access frequency, namely S1F1, S1F2, S2F1, S2F2, S3F1, S3F2, S4F1, and S4F2. S1, S2, S3, and S4 represent core, high, medium, and low sensitivity levels, respectively, and F1 and F2 represent high frequency and low frequency, respectively. All raw medical data are assigned to corresponding cells according to their attributes, and the risk value of each raw data point in each cell is calculated to obtain a batch risk value set X={x1,x2,...,x...} covering all raw data. n }, where n is the total amount of original data; For X, the core criterion for clustering is defined as the within-cluster sum of squares (SDCM), and the specific formula is as follows: Among them, C1, C2, and C3 are three risk intervals to be generated. For interval C i The mean of all risk values ​​within the interval C, where x is the interval C. i A single risk value within; Arrange the batch risk value set X in ascending order to obtain the ordered set X'={x1',x2',...,x n '}, where x1' < x2' < ... < x n '; Determine two breakpoints, denoted as b1 and b2, where b1 < b2, and divide the ordered set X' into three continuous intervals: C1 corresponds to [min(X'), b1], C2 corresponds to (b1, b2], and C3 corresponds to (b2, max(X')]. Enumerate all possible combinations of breakpoints. For each breakpoint combination, calculate the intraclass sum of squares of the three intervals, sum them to obtain the total SDCM of the combination, and select the breakpoint group with the smallest total SDCM from all combinations. The corresponding three intervals are the optimal risk intervals for batch data. The three generated optimal risk intervals are sorted according to the range of risk values ​​they contain, resulting in a low-range interval, a medium-range interval, and a high-range interval. The sorting results are then linked to the risk level: the high-range interval is classified as a high-risk level, the medium-range interval as a medium-risk level, and the low-range interval as a low-risk level. The low-range interval represents the interval containing the minimum risk value among the optimal risk intervals, the high-range interval represents the interval containing the maximum risk value among the optimal risk intervals, and the remaining interval corresponds to the medium-range interval.

5. A medical data security management method according to claim 1, characterized in that, Different anonymization processes were performed on data at high, medium, and low risk levels. The specific steps were as follows: For high-risk levels, a full-field replacement plus random perturbation is used; for medium-risk levels, partial masking plus format preservation is used. For low-risk levels, only label desensitization is performed; The specific content of the full-field replacement + random perturbation method is as follows: Analyze the data structure in the high-risk level and locate all core sensitive fields, including identification fields and content fields; for identification fields, use meaningless character replacement; for non-numerical content fields, use semantically irrelevant replacement; for numerical content fields, generate random perturbation values ​​within a preset safety range, but ensure that the perturbed data still conforms to the medical logic range, and then perform format obfuscation on the perturbed values ​​again. The specific content of the partial masking + format retention method is as follows: clearly define the format elements that need to be retained and the sensitive parts that need to be masked for each data in the medium-risk level. The format elements that need to be retained include data units, number of digits, and key identifiers. The sensitive parts that need to be masked include the middle digits of the precise value and non-key personal identifiers. For numerical data, mask the middle precision bits while retaining the first and last bits and units; for text-based diagnostic records, mask the detailed description while retaining the core diagnosis; for identifier-type data, mask the middle date portion.

6. The medical data security management method according to claim 1, characterized in that, The specific steps for real-time monitoring of whether an operation is within the scope of permissions are as follows: The generated permission scope is transformed into a structured set of feature tags, containing four core verification features: patient association features, a set of patient IDs bound to the current task; data field features, specific data field tags that are allowed to be operated on; operation type features, allowed operation actions; and device binding features, a list of authorized device fingerprints. When data retrieval, modification, and transmission operations are triggered, the lightweight parsing module extracts four types of behavioral features of the current operation in real time and compares them one by one with the feature label set. If any dimension does not match, it is marked as a potential anomaly. In combination with the current task scenario, it is determined whether the potential anomaly is a reasonable deviation. If it is a reasonable deviation, the anomaly label is removed; otherwise, it is determined to be a real anomaly.

7. A medical data security management method according to claim 6, characterized in that, If the anomaly is determined to be genuine, the following actions will be taken immediately: ① Immediately freeze the current operation process, but retain the records of completed compliant operations; ② Automatically record the specific characteristics of the anomaly, and associate them with the current task details and user information to generate a standardized anomaly report; ③ Push different levels of alerts to the administrator based on the number of anomaly dimensions.

8. A medical data security management method according to claim 1, characterized in that, The specific steps to obtain the encrypted log chain are as follows: All operation records generated are structured according to four dimensions: operation subject, operation object, operation content, and operation result, generating standardized log entries. Specifically, these include: operation subject, including user ID, role, and operation device fingerprint; operation object, including patient ID and data anonymization features; operation content, including permission range parameters and operation behavior type; and operation result, including normal completion and abnormal interception. The generated structured log entries are fully encrypted using the SM4 national cryptographic block encryption algorithm to generate encrypted log data E. m And the SM3 national cryptographic hash algorithm is used to encrypt the E m Calculate the hash value H m At the same time, the hash value H of the previous log entry is embedded in the current log unit. m-1 This forms "Log Unit = Encrypted Data E" m +self-hashH m +Preorder hash H m-1 The structure is "", where m is the log sequence number; When each log unit is generated, the system automatically requests a unique timestamp T from the National Time Service Center. m , timestamp T m Embed the corresponding log unit to form "Complete Log Unit = Encrypted Data E" m +self-hashH m +Preorder hash H m-1 +timestampT m ", and by timestamp T m The complete log units are aggregated into an encrypted log chain in a specific order and stored on an offline encryption server. Simultaneously, a chain index is generated, which contains the T of each log entry. m With H m .

9. A medical data security management method according to claim 8, characterized in that, The preceding hash H0 of the first log entry is set to the system's default root hash, which is generated by the organization's digital certificate.

Images